{"id":"CVE-2026-107733","revision":"2202c7c3349849388d80fe32485b445d","records":[{"revision":"2202c7c3349849388d80fe32485b445d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-107733","aliases":[],"title":"SumatraPDF: Null-pointer dereference in `CmdExec` when no document tab is open","description":"SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand() handles CmdExec by passing a null current-tab pointer to RunWithExe(), which dereferences WindowTab::filePath. A local process in the same interactive Windows session, at an integrity level greater than or equal to SumatraPDF's under Windows UIPI, can dispatch CmdExec over DDE or WM_COPYDATA while no document tab is open, causing abrupt process termination and loss of unsaved state. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.","state":0,"publishedAt":"2026-10-08T22:23:26.389+00:00","modifiedAt":"2026-10-14T01:33:16.443+00:00","affected":[{"ecosystem":"Vendor product","name":"sumatrapdf","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"sumatrapdfreader\",\n                    \"product\": \"sumatrapdf\",\n                    \"versions\": [\n                        {\n                            \"version\": \"<= 3.6.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":6.8,"severity":"MEDIUM"}],"references":["https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-p2ph-2rvm-q37m","https://github.com/sumatrapdfreader/sumatrapdf/commit/013ad659c7de13fa15624d1f8a24e3231c50516b"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107733","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-107733","identifiers":["CVE-2026-107733"]},"retained":false,"historicalAffected":[]}],"coverage":[]}